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[57] ABSTRACT 

In a local area network (LAN) test instrument, a method for 
detecting duplicate internet protocol (IP) addresses without 
disrupting the LAN is provided. The LAN test instrument 
provides a method of choosing an IP address for itself 
without disrupting the ARP caches of devices connected to 
the LAN. Duplicate IP addresses between devices on the 
LAN may then be tested using a series of network broadcasts 
chosen to elicit responses from as many nodes on the 
network as possible because some nodes respond to some 
types of broadcasts and not others. A data base of the various 
nodes is collected and the newly arriving responses are 
dynamically compared with the responses already in the data 
base to detect duplicate IP addresses. Separate entries in die 
data base for devices having duplicate IP addresses are 
maintained and then displayed to the user of the LAN test 
instrument to selectably and reliably communicate with the 
devices having duplicate IP addresses for further diagnosis 
and correction. 

8 Claims, 7 Drawing Sheets 
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METHOD OF CONFIGURING A VALID IP the source and destination IP addresses. The lowest layer is 

ADDRESS AND DETECTING DUPLICATE IP the physical link layer in which the hardware MAC 

ADDRESSES IN A LOCAL AREA NETWORK addresses are used. 

Maintaining unique MAC and IP addresses for each node 

BACKGROUND OF THE INVENTION 5 is critical for proper functioning of the network. MAC 

This invention relates generally to local area network addresses m commonly understood to be 48 hits in length 

(LAN) test equipment and in particular to a method for while IP addresses are 32 bits in length. MAC addresses are 

configuring a valid internet protocol (IP) address for a LAN hardware addresses, not readily changeable, which are 

test instrument and detecting duplicate IP addresses between assigned according to the manufacturer in the manner of a 

devices in a LAN to serial number. Duplicate MAC addresses thus rarely present 

Increasingly complex LANs now connect mere and more ^P^eins in actual applications 

types of devices including personal computers, work W addrcsscs ' on thc other hani m <ks*gned to be 

stations, file servers, and printers. Network hubs are often dynamically. IP addresses are often assigned when 

the central devices in a network through which information a cUcnt K * U P on *** LAN and an TP address is 

flows. Each client device connects to the LAN via adapters 15 oftcn to clicnt ^ a dynamic host configuration 

called network interface cards (NICs) to form nodes. Con- P** 0001 < DHCP > savcr <* a 0001 P"* 0001 (BOOTP) server 

necting the nodes to the hubs are network links which may Such m aUocatioD uses a table of predetermined 

be unshielded twisted pair (OTP) wire, coaxial cable, or uni< * uc W addrcsses which usuaU y avoids problem of 

fiber optic cable duplicate IP addresses. However, duplicate IP addresses 

Network protocols for controlling the communication of 20 <™tinue ^oc^^articularly in network deWces tot do not 

information^ ^T^£ ^n^^Z^ ^ f*" 

ing Ethernet which is defined according to the IEEE 8023 W< ^. DOm ^* ^° Cat ^ SU * * P™*" OT routcrs - 

standard and Token Ring which is defined according to the Vanous methods have been devised for detecting and 

IEEE 802.5 standard. Ethernet uses a method called carrier- duplicate IP addresses between devices in a LAN. 

sensing multiple access with collision detection (CSMA/ 25 Somc of thcse methods « 111 SC0 P e * c abilitv 

CD) to control infonnation flow and resolve collisions *? < !f to 5l ^P^ 08 ^ addresses only on the local segment of 

between nodes. A node can send infonnation on the network £ 1^ and inay disrupt the reliable operation of the LAN. 

only if no other node is currently sending information. If a Prior art LAN test instruments exist that detect duplicate IP 

node tries to send information at the same time as another a<Wrcsscs °P erate * a similar fashi °n to the above example, 

node, a collision occurs and each node operates according to 30 A S ven W addrcss ^ * tcstcd for duplication by sending 

a defined "back off" procedure to resolve the collisionTEach ** address resolution P rotoco1 (ARP) request and waiting for 

node will wait a random period of time to attempt to send the a tf no rcply w recclve<L mere * n <> duplication, 

information again. However, in determining which TP addresses to test for, the 

Because Ethernet is typically implemented in a baseband, „ ^ * " «ther j^viae no fac^ty to 

broadcast network. everVnooe reaves the Morn^n^m M '"^T^ *«■ * addresses to test ^tmstead allow 

wu ^u wtwvlo *4« in ■ a ■ t only for incrementally testing a range of IP addrcsses one at 

by every other node within the collision domain. In order to ^ .* . « f „ , , 

. . . , Al _ _ • a time or a limited facility in which ARP caches are collected 

minimize the burden on the software operating in host • . . . J . ¥ /r T . 

™.rc rtn «i • a !L i from various devices in the LAN in a passive manner to 

personal computers (PC s) connected to the network, a obtain ^ 

hardware layer with a hardware or media access control ^ . «.« , . , . _ , _ 

(MAC) address passes along to the software layer only the . Thereforc : 11 wo ^ desuMc to P™™* a LAN test 

information appropriate for that node. Such information may ^1^^ ^^A 1 ? w * ch 

be in the form of a 'WtasT message intended for aU *? S the . abflir y to , sclect a valid IP address for itself without 

nodes in the network or as a message only for the intended network operations II would be further 

node with the MAC address desirable to provide a method in a LAN test instrument that 

Monaco ,nt over a, EO,^ oeew.fc is in thc fwm 45 J^KKJS Si SSLT " - 

of discrete packets defined according to the seven layer * 

Open Systems Interconnection (OSI) standard maintained SUMMARY OF THE INVENTION 

by the American National Standards Institute (ANSI). OSI is Id accordance with the present invention, a method for 

a layered structure in which the highest layers take advan- 50 configuring a valid internet protocol (IP) address for a LAN 

tage of the capabilities of the lower layers to send informa- test instrument inserted in a LAN without disrupting the 

tion between nodes. Information is passed between nodes in LAN is provided. The LAN test instrument is inserted into 

the form of discrete packets containing data or control the LAN. which may be an Ethernet Token Ring, or other 

information supplied by the various OSI layers. The highest communications protocol, either at boot up or by physical 

layers are the Application layer, the Presentation layer, and 55 connection to the live network. The test instrument monitors 

the Session layer which may include Telnet File Transfer network traffic on the local network segment for a prede- 

Protocol (FTP), Simple Mail Transfer Protocol (SNMP). and termined period of time to determine top address ranges. 

Domain Namc System (DNS). From the traffic information collected, the LAN test instru- 

The Transport layer typically includes the Transmission ment can identify the most prevalent local addresses on the 

Control Protocol (TCP) along with the User Datagram 60 local network segment and also identify routers which most 

Protocol (UDP), among others, which provide for the deliv- commonly use RIP (router interface protocol) or OSPF 

ery of the data to a desired device and the division of the (open shortest path first) protocols. From the local address 

infonnation into discrete packets for sending. Received ranges, the LAN test instrument may either choose an 

packets are reassembled in a like manner. The Network layer unused IP address or prompt a user to choose an unused IP 

routes messages back and forth between a source node and 63 address within the local address range, 

a destination node according to Internet Protocol (IP) Once an IP address for the LAN test instrument has been 

addresses by adding an IP header to each packet indicating chosen by the user, duplicate IP address checking is per- 
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formed. It is critical that no disruption to the normal opera- BRIEF DESCRIPTION OF THE DRAWINGS 

tion of the LAN occur due to the insertion of the LAN test nG j ^ m fli ustra tion (not to scale) showing a typical 

instrument and the user's choice of an IP address that turns situation - m which a LAN test instrument is inserted into a 

out to be a duplicate of another device currently on the LAN. to dctcct duplicate IP addresses; 

ARP (address resolution protocol) caches, tempraxy 5 . 2 ^ a block dagrarn cf me 1^ 

memory for storing the responses to ARP requests on the ^^gu^^t havingT duplicate IP address is 

local segment are updated with each ARP request received a ™*» ™ f*™* ™r ^ 

and are tos subject to corruption due to duplicate IP inscrted * c ^ 

detection by conventional meant FIG. 3 is a amplified block ^agram oftheLAN of FIG. 

The method according to present invention provides for to 2 showing *e effe^ on me ARP caches of nodes caused by 

duplicate IP testing using a pre<fctermined, unique source IP the misconngured dient; 

address for the sender IP address and the target address of FIG. 4 is a simplified block diagram of the LAN of FIG. 

the desired IP address fox an ARP request to avoid corrupting 2 in which the LAN test instrument according to the present 

the ARP caches of the other hosts on the network with invention is inserted into the LAN to detect duplicate 
invalid addresses, and also to avoid generating console error is addresses; 

messages and log file errors. In the preferred embodiment, FIG. 5 which includes FIGS. 5A and SB together com- 

the predetermined, unique source IP address is one reserved prise a flow diagram of the process of inserting the LAN test 

to the manufacturer of the LAN test instalment and therefore instrument into the LAN to detect duplicate IP addresses 

known not to be local to the LAN being tested. according to the present invention; and 

If no reply is received by the LAN test mstrument, a 20 fig. 6 is a simplified block diagram of the LAN test 

second ARP request with the desired IP address as both mstrument according to the present invention. 

sender and target IP addresses, commonly known as a 

gratuitous AREis sent and replies will be monitored for by DETAILED DESCR^ON OF THE 

the LAN test instrument When the desired IP address has INVENTION 

been verified by the LAN test instrument the desired IP 25 n san illustration (not to scale) of a typical situation 

address is adopted as the IP address of the LAN test m w i£ch a LAN test instrument 10 according to the present 

instrument invention is inserted into a LAN (local area network) 12 via 

The method according to the present invention further a patch cable 14 to detect duplicate IP addresses, first 

provides for automatically detecting duplicate IP addresses ^ between a desired IP address of the LAN test instrument 10 

between devices on the network by generating a series of and any node in the LAN 12 and then between any pair of 

network broadcast requests and dynamically comparing nodes within the LAN 12. The LAN 12 may comprise any 

each response to past responses stored in a data base in the number of physical hardware components including a router 

LAN test instrument Because some devices on the LAN 26 and shared hub 22 for connecting clients 16. 18. and 20. 

may respond to some types of network broadcast requests ^ The clients 16. 18, and 20 are coupled to the shared hub 22 

and not others, the series of network broadcast requests via ports 28. The shared hub 22 is further coupled via a cable 

consists of various types chosen to elicit responses from as 24 to a port on the router 26 which provides connections to 

many devices as possible on any given LAN. The number omer areas of the LAN 12 (not shown). Other commercially 

and mix of types may be arrived at by reasonable experi- available network hardware including repeaters, switching 

mentation given the present mix of devices on the LAN. As ^ hubs, bridges, and media access units (MAUs) may be 

each of the responses are received by the LAN test included within the LAN 12. The LAN 12 thus comprises a 

instrument the address information contained in the system of hardware and cables to form the physical layer 

response is dynamically compared to the information from according to the well-known Open Systems Interconnection 

past responses in the data base to detect duplicate IP (OSI) model. 

addresses. The data base maintains separate entries for each ^ Each of the clients 16, 18, and 20 have network adapters 

device having duplicate IP addresses, allowing the user to commonly referred to as network interface cards (NICs) for 

reliably select and communicate with the devices having a hardware connection to the LAN 12. Each of the clients has 

duplicate IP addresses for purposes of further diagnosis and a physical hardware address commonly referred to as the 

correction. media access control (MAC) or hardware address. The 

One object of the present invention is to provide a method ^ hardware layer operates as a filter that passes only messages 

for automatically configuring a valid IP address for a LAN received from the network that are broadcast messages or 

test instrument addressed to that particular MAC address. Because MAC 

Another object of the present invention is to provide a addresses are assigned according to manufacturers by 

method for detecting duplicate source IP addresses without industry-wide agreement and in the form of a unique serial 

disrupting the operation of a LAN. 55 number for each hardware device, duplication of MAC 

An additional object of the present invention is to provide addresses is not a concern. The ports of the router also have 

a method for detecting duplicate IP addresses and reliably MAC addresses that operate in a similar manner to those of 

cornmumcating with selected devices having the duplicate the clients 16. 18. and 20. 

IP addresses in a LAN. Each of the clients 16. 18, and 20 further have IP 

A further object of the present invention is to provide a 60 addresses that operate on the software or network leveL 

LAN test mstrument capable of being inserted into a LAN Although many clients have statically-configured IP 

to detect a duplicate IP addresses without disrupting the addresses, such IP addresses are readily assignable by the 

operation of the LAN. network administrator and are sometimes assigned at boot 

Other features, attainments, and advantages will become up by the BOOTP or DHCP server (not shown) on the LAN 

apparent to those skilled in the art upon a reading of the 65 which maintains a pool of unique IP address to draw from, 

following description when taken in conjunction with the IP addresses for any particular client may change each time 

accompanying drawings. the device is booted up on the network. For the LAN 12 to 
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operate property, each device oo die network, including the 18. will automatically disconnect from the network or pro- 
clients 16. 18. and 20 as well as each of the ports of the vide an error message to the network manager indicating the 
router 26. must have a unique IP address at any given time. duplicate IP address problem so that it may be resolved. 

The physical hardware responds only to a specific MAC However, in generating the gratuitous ARP. the ARP 

address or the MAC broadcast (OxFFFFFEFFFFFF) thus 5 caches of the client 16 and the router 26 have been corrupted 

acting as a filter which reduces the burden on the software ™* * e ^A C of the client 20. now disconnected. 

inii«^n l, „,-„,„ ,f , c „„. ~n T , ■ „„„, instead of the client 18. which remains properly connected. 

toy fJS f , • 18 - 28 B 1 l n „ ! ^! s !f y ^ In the ARP tables of the router 26 and the diem 16. the MAC 

anARP(»d<iressresol U Uon^ address^3?shown in the circle, would be replaced with the 

dynamically map W addresses to correspo riding MAC improper mac address of 4 . result of th^comrption of 

addresses. Broadcasts such as ARP cornmands typically "> ls ^ Option of ^^^^ 

must be rninumzed because the physical hardware of every ^ ^ ARP " caches OT refreshed 

oevtce on tne law receiving ue Dioaacast passes me p^^™ ^ 

according to the prior art is not 

J' 08 !K t!^?* « completely reliable in that some clients dfnot perform 

ARPrequest may be broadcast for each time that data must ^^J^s ^ ^ eo , tbm t0 ^ a dupUcate source 

be transferred from one deviceon the network to another. » glunu. ^ to me lan unt 5 ^ ^cm 

such requests are relatively Inefficient and cause excessive . - . L~„,„„u 

broadcast traffic. Alternatively. ARP caches within each of 15 eventuaUv found ^ solved manually, 

the clients 16. 18 and 20 and the router 26 for temporarily tea instruments exist that detect duplicate 

staring IP to MAC address maps may be used to ininimize «■■* f ^^ifPf^ * a ^l^ ab r= 

the number of ARP commands sent. The entries in the ARP 20 «*»Plc- A given IP address imay be tested f. duplication by 

cache each containing an IP to MAC address mapping are $endm 8 80 ARP request and waiting for a reply If muluple 

usually set by default option to expire after 20 minutes. "g* 4 « recaved - *" *« » J***"/, ! £P hcMe ? 

» , , . . . .. . 7». . ,. „ address between several devices in the LAN 12. However, in 

IX has been recognized in the LAN field that dupkeate IP detennining which jp addrcsses t0 test for a dupUcate IP 

addresses can and still do occur in LANs and that it is address , somc prior art LAN test instnirnents provide no 

desirable to provide means for detecting and correcting for 23 fadli to automatically ^ such rp addresses but instead 

duphcate IP addresses between network devices. FIG. 2 is a ^ on , for ^^^1^ a 0 f IP addresses 

simplified block diagram of the LAN 12 in which a mis- one at a time. Other prior art LAN test instruments may 

coimguxed cUent 20 having a dupUcate IP address of 010 is instcad ide a Un ^ ted fadlit ^ t0 obtain jp addnssts £ 

inserted into the LAN 12. Such insertion can be either the test in which ARP caches are collected from various devices 

physical plugging in of the client 20 into one of the ports 28 . T AKJ . n ~ „, 0 „„ ^ «k*, : „ n> 

^ A *_ , . ... „ . \. in the LAN 12 in a passive manner to obtain the IP 

of the shared hub 22 or the booting up of the client 20 addresses 

already connected to the LAN 12. Each of the clients 16. 18, * . . AV „ . - . ^ 

. -i • . . A1 . T cc^iaTTvrr i • FIG. 4 shows the same LAN 12 as in FIG. 3 but with the 

and 20 are on the same LAN SEGMENT 1 which is T *vt* - • mau- • — > a • i . 

, , . . . , LAN test instrument 10 being inserted in place of the client 

provided by the shared hub 22. The router 26 provides a ZZT ™ ^ . ' v rl j: « _IL " 2 . \T 

*u * r *v onmimrr i u- 1. 1. i* . 4* j 35 20 as shown. The LAN test mstrument 10 must first be 

pathway to a LAN SEGMENT 2 which has clients 30 and , . _ m . . ^ „ . ^_ . _ . 

32 connected. configured with an IP address that is compatible with the 

remaining portions of the LAN 12. It is often desirable that 

Each of the clients 16, 18. and 20 contain an ARP cache me jp address of the LAN instrument 10 can be readily 

which contains the entries that each map an IP address to a configurable by the user for diagnostic purposes, such as to 

MAC address and that are obtained through ARP requests, ^ substitute mc lan test instrument 10 for another device 

either by the dient itself or are updated by other ARP with the same IP address. It is also desirable that the user 

requests from other devices on the same LAN segment if the have some guidance in choosing a proper IP address by 

entry already exists. The router 26 does not relay ARP providing ^ local su bliet address range to be compatible 

requests to other segments but may answer for the clients 30 mc devices on the same LAN segment. After the user 

and 32 if the router 26 has Proxy ARP capability as is ^ tias chosen an IP address, the LAN test mstrument 10 checks 

commonly known in the art. for duplicate IP addresses in a manner that does not corrupt 

Within any given segment of the LAN 12. including the the ARP caches of other devices as explained in further 

LAN SEGMENT 1 and LAN SEGMENT 2 as shown, there detail below. 

may be blocks of IP addresses assigned that define local After it has been established that there are no duplicate IP 
subnets according to subnet masks. Clients in one local 50 addresses between the LAN test mstrument 10 and other 
subnet are generally more closely associated with each other clients on the local subnet, further analysis is conducted to 
than with clients on another local subnet. For example, local detect duplicate IP addresses between other client within the 
subnets may be assigned according to different work groups LAN 12. A series of network broadcast requests are sent that 
within an organization to simplify network administration consist of various types which include an ICMP (internet 
tasks. A subnet broadcast may be created that targets all of 55 control message protocol) ping, an ICMP address mask 
the clients configured for one local subnet but is not received request, a UDP ping and an SNMP (simple network man- 
by clients configured for another local subnet agement protocol) ping. The number and mix of the types of 
FIG. 3 shows the operation of the LAN network 12 network broadcast requests are chosen is designed to elicit 
according to a prior art protocol for detecting duplicate replies from as many devices as possible from as many 
source IP addresses. The client 20 is miscorifigured in that its 60 subnets as possible from the LAN SEGMENT 1. Some 
IP address of 010 is the same IP address as the client 18 devices respond to some network broadcast requests but not 
which is already connected to the network. Upon boot-up. others. Many devices do not advertise their presence on the 
the client 20 sends out a gratuitous ARPrequest with its own LAN 12. such as passive routers or printers, and such 
D? address of 010 to determine if its source JP address is devices must be affirmatively prompted using the appropri- 
already in use by another client In doing so. the client 18. 63 ate network broadcast requests. The number and composi- 
having the same IP address of 010 responds to the ARP. tion of the types in the series of network broadcast requests 
request. The client 20. upon seeing the response from client according to the present invention may be readily expanded 
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and modified using a reasonable amount of experimentation LAN test instrument IP: 128.001.002. 

to accommodate different types of network devices as they The user is prompted to fill in the Last three blanks of the 

are developed. LAN test instrument IP based on the local address range 

As each of the responses from each network request are which, in this example, allows addresses from 0 to 255 for 

received, a data base is constructed containing MAC and IP 5 the last three digits. The IP address of the nearest router and 

addresses of the responding devices as well as further the local subnet mask may also be provided to give further 

information as to the type of device. Unlike the ARP cache. guidance to the user in making an initial selection of a 

however, the incoming responses from the network devices desired IP address. 

are analyzed in a dynamic fashion and compared against the ]q stC p no labeled Check for Duplicate IP Addresses 

data base to detect duplicate IP addresses. Duplicate IP 10 BcrweeQ Test Instrument and Local Subnet, the LAN 

addresses that are detected are then displayed to the user of test ^tru^t 10 checks for a duplicate IP address between 

the LAN test instrument 10 and further inferoation obtained ^ sourcc w ^foss entered by the user in step 1*8 

from the data base is provided to allowfor oiagnosis of the ^ ^ found mthcLAN1Z To avoid corrupting 

network devices having the duplicate IP addresses. ^ ^ cad)CS of ^ to ±c local 

The data ^ according to the prewnt invention allows of the LAN 12. the LAN test instrument 10 first 

for more readily diagnosing * ^/* s sends an ARP request with a predetermined unique source IP 

reliably commumcating with the devices that have the the target IP address of the desired source IP 

duplicate IP addresses than prior art methods using only 7? . , . * mmr 

ARP caches. Separate entries in the data base are maintained address entered by the user. 

r^^^- lw^TZT Tl j . Id this way. although the ARP caches of the other devices 

for each MAC address of the devices having duplicate IP ^ u * t0 iXte an entry for the unique IP address 

addresses, allowing for directed corr^catio^ such as 20 "^ZT^^ 

SNMP. queries to the selected SI eruption for the entries of devices having a 

cate IP proWem in order to Kknufy the misconfi^ed ^ ^ w as occur in the prior art methods If 

devices In this way. duplicate IP addresses may be further ^y to the first ARP meaning there is no 

analyzed and corrected if necessary by remote commands to ^ the LAN test instrument^ then sends 

J^T? ^ 0n ^ . fl f a second gratuitous ARP request with the desired IP address 

FIGS. 5 A and SB together comprise a flow diagram of a ^ ^ ^ ^ ^ ^ to fix the ARP 

process according to the present ^ventioo of inserting the caches ofthc ^ Evicts in order to correctly map to the 

LAN test instrument into the LAN with a proper IP a ^ es ^ desired source IP address that has been adopted by the LAN 

and then sending a series of network requests to detect ^ te$t mstrument 10 

duplicate IP addresses between devices on the network. ^ JR labeled Source w Addrcss? , if a 

Referring now to FIG. 5 A. there is shown the step 160 frphcate JP address if found between the desired source IP 

labeled Begin in which it is desired that the LAN test address entered by the user and any address in the LAN 12. 

instrument 10 (shown in FIG. 1) be connected to the LAN ^ loops back to step 108 so that the user may be 

12 for diagnostic purposes. The LAN test instrument 10 may J5 pr<m p boA for another source IP address. It would be desir- 

be connected directly to the shared hub 22 via the patch able that an error message stating that there is a duplicate IP 

cable 14 or to a wall outlet in a user area that connects to the address ^ generated and displayed to the user to prevent 

LAN 12 via a longer link cable (not shown). confusion. 

In step 102 labeled Insert Instrument Into Network, the ^ stcp 114 lathed Determine Local Router and Subnet 

LAN test instrument 10 is either physically connected to the w MasJc routers connected to the local segment are also 

LAN 12 or bootcd-up on the LAN 12. LAN 12 may be determined by the LAN test instrument 10. In this case the 

running Token Ring, Ethernet, or another network protocol routcr 26 connected to the LAN SEGMENT 1 would be 

which operates according to a baseband, broadcast principle found m & displayed to the user of the LAN test instrument 

in which devices have unique hardware and software 10. The local subnet mask would be toermined according to 

addresses. The precise method of insertion thus varies 43 appropriate ICMP and SNMP inquiries directed to the 

according to the particular protocol of the network but is devices on the local subnet 

typically done in the conventional manner for Ethernet or Referring now to FIG. 5B. in step 116 labeled ICMP Ping, 

Token Ring. the LAN test mstrument 10 generates several broadcast 

In step 104 labeled Monitor Traffic on Local Segment the pings. The ICMP Ping will request a response from all 

LAN test instrument 10 passively monitors the data traffic 50 devices that respond to the limited broadcast (TP address 

being sent by other devices on the local segment in this case 255 .255.255.255) and to the subnet broadcast. 

LAN SEGMENT 1 for a predetermined period of time. The in step U8 labeled Dynamic Analysis which further 

LAN test instrument 10 operates with its hardware interface comprises step 120 labeled Receive Device Responses, step 

in promiscuous mode, which is commonly understood to 122 labeled Compare and Save Results in Data Base, and 

mean that all network traffic is passed to the software layer 55 step 124 labeled Detect Duplicate IP Addresses. As each 

for analysis. response arrives at the LAN test instrument at step 120. the 

In step 106 labeled Identify Local Address Ranges, the address information is compared against past responses that 

LAN test instrument 10 analyzes the data traffic collected in have been stored in the data base to check for duplicate TP 

step 104 to determine the address ranges of the devices used addresses in step 122. If the information contained in the 

on the local segment of the LAN 1Z 60 response is new. such as a response from a newly found 

In step 108 labeled Prompt User for IP Address, the LAN device on the LAN 12. the information is saved in the data 
test instrument 10 displays the address information obtained base as a past response. 

from the analysis of step 106 and allows the user to select an Responses from the devices connected to the LAN 12 are 
IP address that would be valid for the local segment. For systematically collected and stored as past responses in 
example, the following information could be displayed to « order to build a more complete data base of the devices 

the user as dotted H^mai notation commonly used in the connected to the LAN 12. The responses are all analyzed the 

industry for 32 bit IP addresses: same way in the step 114 and the data base is built using the 
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responses which are stored as past responses. The order in Id step 132 labeled Display Duplicate IP Addresses, any 
which the responses arrive is thus not critical because no duplicate IP addresses that are found in the step 124 may be 
information is lost as the data base accumulates unique displayed to the user, along with additional diagnostic or 
information about the devices on the LAN 12 corresponding error information. Such information is typically displayed 
to the MAC and IP addresses contained in the responses. If 5 numerical on a graphical user interface of the LAN test 
identical IP addresses are found but the corresponding MAC instrument 10. 

addresses are different, step 124 detects the duplicate IP In step 134 labeled End. the duplicate IP address detection 
address. Additional device information from the information method terminates. Duplicate IP detection according to the 
collected in the data base may be provided along with an present invention may be set to return to step 104 to 
error message alerting the user of the LAN test instrument 10 continually monitor for duplicate IP addresses on an 
10 of the duplicate IP address. on-going basis. 

The data base according to the present invention allows In FIG. 6. there is shown a simplified block diagram of the 
for more readily diagnosing duplicate IP addresses and more LAN test instrument 10. A hardware interface 200 is coupled 
reliably comnmiucating with the devices that have the via the patch cord 14 to the LAN 12 in the well known 
duplicate IP addresses. Separate entries are maintained for 15 manner. The hardware interface 200 operates in a similar 
each MAC address of the devices having duplicate IP manner to commonly available network adapters and may be 
addresses. These entries may be displayed to the user on the adapted for connection to LANs that operate with Ethernet 
display 214, allowing the user to selectively and reliably or Token Ring protocols. The hardware interface 200 has a 
communicate with selected devices having duplicate IP MAC address assigned according to industry standards and 
addresses using the keypad 216. In this way, reconfigured 20 may be assumed to be unique to the particular LAN test 
devices having duplicate IP addresses may be further diag- instrument 10. The hardware interface may be configured to 
nosed using directed commands to determine, for example, selectively receive information that is targeted for the par- 
the device type and configuration of each selected device. ticular MAC address and the MAC broadcast address or, in 
Such information may be readily obtained in a conventional promiscuous mode, to receive all information present on the 
manner as long as the MAC and IP addresses of the selected 25 local segment of the LAN 12. 

device are known. The duplicate IP address in the selected A software interface 202 is coupled to receive the infor- 
device may be then corrected if necessary using remote mation provided by the hardware interface 200. The soft- 
commands to change the IP address of the selected device to ware interface 202 may be implemented as a stand-alone 
a new IP address that is not a duplicate of any other IP interlace or it may be implemented entirely in software as 
address of the devices on the LAN 12. 30 executed by a microprocessor 204. The software interface 

Traditional ARP caches, on the other hand, do not allow 202 has a readily configurable IP address. A switch 206 
for comparisons dynamically but are designed only for static provides for toggling between a desired IP address 208 as 
retrieval which does not allow for detection of duplicate IP selected by the user and a unique IP address 210. The switch 
addresses. Furthermore, IP address and MAC address infor- toggles between the desired IP address 208 and the unique 
mation may be lost because the duplicate IP information is 35 IP address 210 during the step 110 shown in FIG. 5A when 
overwritten as one associated entry. successive ARP requests are sent to check for duplicate IP 

In step 126 labeled Generate UDP Ping, the LAN test addresses in a manner that avoids corrupting the ARP caches 
instrument 10 generates several broadcast UDP (User Data- of other devices on the LAN 12. 

gram Protocol) pings. The UDP ping differs from the ICMP The microprocessor 204 is coupled to the software inter- 
Ping of step 116 and may elicit responses from different 40 face 202 to send a series of network requests as performed 
devices that have not yet responded. The responses to the in steps 112 and 122-128 to the devices in the LAN 12 and 
UDP ping are received and analyzed in the step 118 for receive responses from the software interface 202 that are 
duplicate IP addresses. received back from the devices in the LAN 12 responsive to 

In step 128 labeled Generate SNMP Ping, the LAN test the network requests. The information received contains IP 
instrument 10 generates several broadcast SNMP ping 45 addresses and MAC addresses from the devices on the LAN 
requests. The SNMP broadcast ping request may elicit 12. The microprocessor 204 dynamically compares the 
responses from different devices that have not yet incoming IP addresses and MAC addresses with the IP 
responded. The responses to the SNMP pings are received addresses and MAC addresses stored in a data base in a 
and analyzed in the step 118 for duplicate IP addresses. memory 212 to detect duplicate IP addresses. 

In step 130 labeled Generate ICMP Address Mask 50 A display 214 and a keypad 216 comprise a user interface 
Request the LAN test instrument 10 generates several of the LAN test instrument 10. The LAN test instrument 10 
ICMP broadcast mask requests. The ICMP mask request prompts the user via the display 214 to enter the desired IP 
may elicit responses from different devices that have not yet address 208 using the keypad 216 based on the subnet 
responded. The responses to the ICMP broadcast mask address ranges found on the local segment of the LAN 12. 
requests are received and analyzed in the step 118 for 55 Duplicate IP addresses that are found can be displayed on 
duplicate IP addresses. the display 214. 

The steps 116. 126. 128. and 130 thus comprise the series It will be obvious to those having ordinary skill in the art 
of broadcast network requests. Each of the steps 116. 126, that many changes may be made in the details of the above 
128. and 130 are of different types of broadcast network described preferred embodiments of the invention without 
requests which have been chosen through empirical experi- 60 departing from the spirit of the invention in its broader 
mentation to produce the responses from as many devices as aspects. For example, the method according to the present 
practically possible given the current mix of device types invention may be readily adapted to different network pro- 
found in a typical LAN 1Z As the mix of device types tocols that allow for unique addressing of network devices, 
changes over time and for different types and sizes of the The scries of broadcast network requests generated in the 
LAN 12. the types represented by the steps 116. 126. 128. 65 steps 116, 126. 128. and 130 need not be generated in the 
and 130 may change in number and composition based on particular order as presented and the series may be readily 
reasonable experimentation. adopted for greater or fewer such requests according to the 
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composition of device types on the particular LAN being 
tested. Therefore, the scope of the present invention should 
be determined by the following claims. 
What we claim as our invention is: 

1. In a LAN test instrument for inserting into a LAN 
containing a plurality of devices having ARP caches, a 
method for configuring a desired IP address in said LAN test 
instrument without disrupting said LAN. comprising: 

(a) monitoring data traffic in said LAN for a predeter- 
mined period of time; 

(b) determining at least one local address range based on 
said data traffic; 

(c) prompting a user for said desired IP address based on 
said local address range; 

(d) generating an ARP request with a unique IP address as 
a source IP address and said desired IP address as a 
target IP address; and 

(e) if no reply is received from said devices, generating a 
second ARP request with said desired IP address as said 20 
source IP address and as said target address wherein 
said LAN test instrument is configured with said 
desired IP address without corrupting said ARP caches. 

2. In a LAN test instrument for inserting into a LAN 
containing a plurality of devices having ARP caches, a 25 
method for configuring a desired IP address in said LAN test 
instrument without disrupting said LAN according to claim 

1 wherein said LAN operates according to an Ethernet 
protocol. 

3. In a LAN test instrument for inserting into a LAN 30 
containing a plurality of devices having ARP caches, a 
method for configuring a desired IP address in said LAN test 
instrument without disrupting said LAN according to claim 

1 wherein said LAN operates according to a Token Ring 
protocol. 

4. In a LAN test instrument for inserting into a LAN 
containing a plurality of devices having ARP caches, a 
method for configuring a desired TP address in said LAN test 
instrument without disrupting said LAN according to claim 
1 further comprising: 

(a) finding router IP addresses connected to said LAN; 

(b) determining local subnet masks; and 

(c) prompting said user for said desired IP address based 
on said local subnet mA<ir* and said router IP addresses. 
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5. In a LAN test mstrument for inserting into a LAN 
containing a plurality of devices* a method for detecting a 
duplicate IP address between any of said plurality of devices, 
comprising: 

(a) generating a series of broadcast network requests; 

(b) receiving responses from said devices according to 
said broadcast network requests, said responses con- 
taining IP addresses and MAC addresses corresponding 
to said devices: 

(c) dynamically comparing said responses to past 
responses stored in a data base; 

(d) maintaining separate entries in said data base for each 
of said devices having said duplicate IP address; 

(e) detecting said duplicate IP address if said IP addresses 
of said responses match said IP addresses of said past 
responses and said MAC addresses do not match a 
corresponding MAC address of said past responses; 

(f) generating an error message for said duplicate IP 
address. 

(g) selecting one of said separate entries; and 

(h) selectively conmiunicating with one of said devices 
corresponding to said one of said separate entries. 

6. In a LAN test instrument for inserting into a LAN 
containing a plurality of devices, a method far detecting a 
duplicate IP address according to claim 5 further compris- 
ing: 

(a) diagnosing said one of said devices; and 

(b) correcting said duplicate IP address in said one of said 
devices. 

7. In a LAN test instrument for inserting into a LAN 
containing a plurality of devices, a method for detecting a 
duplicate IP address according to claim 5 wherein said series 
of network requests contains a plurality of types chosen to 
elicit said responses from a maximum number of said 
devices. 

8. In a LAN test instrument for inserting into a LAN 
containing a plurality of devices, a method for detecting a 
duplicate IP address according to claim 7 wherein said types 
comprise ICMP pings, UDP pings, and SNMP pings. 
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